Read the docs
TI-2004-01941 Aliases CVE-2004-2068GHSA-cxw2-7p57-jf87

fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of…

Priority LOW 26Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service (process hang) via an empty NNTP news article with missing mandatory headers.

Why it matters now

EPSS 0.01634 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:leafnode:leafnode:1.9.25:*:*:*:*:*:*:*1.9.25VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.26:*:*:*:*:*:*:*1.9.26VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.27:*:*:*:*:*:*:*1.9.27VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.28:*:*:*:*:*:*:*1.9.28VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.29:*:*:*:*:*:*:*1.9.29VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.30:*:*:*:*:*:*:*1.9.30VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.31:*:*:*:*:*:*:*1.9.31VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.32:*:*:*:*:*:*:*1.9.32VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.33:*:*:*:*:*:*:*1.9.33VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.34:*:*:*:*:*:*:*1.9.34VulnerableLeafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.25:*:*:*:*:*:*:* Versions 1.9.25 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.26:*:*:*:*:*:*:* Versions 1.9.26 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.27:*:*:*:*:*:*:* Versions 1.9.27 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.28:*:*:*:*:*:*:* Versions 1.9.28 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.29:*:*:*:*:*:*:* Versions 1.9.29 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.30:*:*:*:*:*:*:* Versions 1.9.30 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.31:*:*:*:*:*:*:* Versions 1.9.31 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.32:*:*:*:*:*:*:* Versions 1.9.32 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.33:*:*:*:*:*:*:* Versions 1.9.33 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.34:*:*:*:*:*:*:* Versions 1.9.34 Vulnerable ·Leafnode
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:leafnode:leafnode:1.9.35:*:*:*:*:*:*:*1.9.35VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.36:*:*:*:*:*:*:*1.9.36VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.37:*:*:*:*:*:*:*1.9.37VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.38:*:*:*:*:*:*:*1.9.38VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.39:*:*:*:*:*:*:*1.9.39VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.40:*:*:*:*:*:*:*1.9.40VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.41:*:*:*:*:*:*:*1.9.41VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.42:*:*:*:*:*:*:*1.9.42VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.43:*:*:*:*:*:*:*1.9.43VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.44:*:*:*:*:*:*:*1.9.44VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.45:*:*:*:*:*:*:*1.9.45VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.46:*:*:*:*:*:*:*1.9.46VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.47:*:*:*:*:*:*:*1.9.47VulnerableLeafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.35:*:*:*:*:*:*:* Versions 1.9.35 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.36:*:*:*:*:*:*:* Versions 1.9.36 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.37:*:*:*:*:*:*:* Versions 1.9.37 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.38:*:*:*:*:*:*:* Versions 1.9.38 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.39:*:*:*:*:*:*:* Versions 1.9.39 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.40:*:*:*:*:*:*:* Versions 1.9.40 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.41:*:*:*:*:*:*:* Versions 1.9.41 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.42:*:*:*:*:*:*:* Versions 1.9.42 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.43:*:*:*:*:*:*:* Versions 1.9.43 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.44:*:*:*:*:*:*:* Versions 1.9.44 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.45:*:*:*:*:*:*:* Versions 1.9.45 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.46:*:*:*:*:*:*:* Versions 1.9.46 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.47:*:*:*:*:*:*:* Versions 1.9.47 Vulnerable ·Leafnode

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-2068
  2. 2026-10-03 Alias added: GHSA-cxw2-7p57-jf87

References

Patch 1

Other 2

  • TI-2003-00687 The fetchnews NNTP client in leafnode 1.9.3 to 1.9.41 allows remote attackers to cause a… CVSS 2.0MEDIUM 5.0
  • TI-2002-01582 The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a… CVSS 2.0MEDIUM 5.0
  • TI-2005-01375 fetchnews in leafnode 1.9.48 to 1.11.1 allows remote NNTP servers to cause a denial of… CVSS 2.0MEDIUM 5.0
  • TI-2005-01812 The fetchnews NNTP client in leafnode 1.11.2 and earlier can hang while waiting for input… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences